CN115664695B - A comprehensive assessment method based on the cyberspace security situation reflected by QR codes - Google Patents

Abstract

The invention discloses a comprehensive evaluation method of network space security situation based on two-dimensional code reflection, and belongs to the technical field of network space security situation evaluation. According to the invention, the initial weight of each level of unit network space safety factors is determined by adopting an improved analytic hierarchy process, so that the quick matrix fitting of indexes among multi-level structures in the decision process can be realized, the rationality in the decision process is improved, the amplification effect caused by reciprocal of every two indexes is avoided, the comprehensive evaluation precision is realized afterwards, the network space safety problem is quickly found, the feedback is carried out through the two-dimension code, the proposal and adjustment of the network safety factors are facilitated, the judging capability of the power basic network space safety situation is improved, the method can be used for evaluating the network space safety situation of a plurality of power industry practise units, and the visual and quantitative evaluation reference is provided for network safety supervisor participating in evaluation units.

Description

A comprehensive assessment method based on the cyberspace security situation reflected by QR codes

Technical field

The invention belongs to the technical field of cyberspace security situation assessment, and in particular relates to a comprehensive assessment method based on the cyberspace security situation reflected by two-dimensional codes.

Background technique

With the development of the Internet, cyberspace is affecting all aspects of social life. Cyberspace security relies on information networks. Network security and application security are necessary components of the protection of critical information infrastructure. The network security of power industry infrastructure also Regarding the protection of people's lives, power industry units usually have multiple levels. They can be divided into head offices, provincial companies, municipal companies, and district and county companies according to geographical areas. According to business, they can be divided into main business companies (for example: power transmission, Electricity production) and professional business companies (e.g. scientific and technological research, business development). With the development of science and technology, the security situation of cyberspace,

How to intuitively evaluate the situation faced by the power industry unit itself and its subordinate units in the field of cyberspace security is a technical problem faced by the network security business management department. However, due to the interactive weights between the hierarchical structure of the multi-level power industry units, It is relatively complex and has a complex hierarchical structure. When evaluating the cyberspace security work of units in the power industry, the interaction between weights can easily affect the evaluation accuracy. Therefore, there is room for improvement.

Contents of the invention

The purpose of this invention is to: in order to solve the problem that it is difficult to intuitively evaluate the situation faced by the power industry unit itself and its subordinate units in the field of cyberspace security, a comprehensive assessment of the cyberspace security situation reflected by the QR code is proposed. method.

In order to achieve the above objects, the present invention adopts the following technical solutions:

A comprehensive assessment method based on the cyberspace security situation reflected by QR codes, which specifically includes the following steps:

S1. Determine the cyberspace security factors of units at all levels based on the unit level;

S2. Analyze the weight of cyberspace security factors of units at all levels based on the unit level;

S3. Collect data on cyberspace security factors of units at all levels based on the unit level;

S4. Determine and display the cyberspace security situation of units at all levels based on the unit level;

Among them, the weights of cyberspace security factors for units at all levels are adjusted according to their levels to reflect their cyberspace security situation.

As a further description of the above technical solution:

The cyberspace security situation of the electric power industry unit is reflected through a network security QR code, and the network security QR code is generated by corresponding cyberspace security factors.

As a further description of the above technical solution:

The cyberspace security factors include cyberspace security factors as deducted points and cyberspace security factors as bonus points, and the cyberspace security factors with bonus points are used to influence the weight of the determination of the cyberspace security situation.

As a further description of the above technical solution:

The cyberspace security factors are divided into: first-level cyberspace security factors and secondary cyberspace security factors;

The first-level cyberspace security factors are divided into security management factors, security construction factors, security operation factors and security effect factors;

Among them, the secondary cyberspace security factors in terms of security management include: completion rate of important network security tasks and compliance rate of network security-related work;

The secondary cyberspace security factors in terms of safety construction include: progress compliance rate of key construction projects and progress compliance rate of key promotion projects;

Secondary cyberspace security factors in terms of safe operation include: rectification rate of high-risk network security issues in the power system, rectification rate of medium- and low-risk network security issues in the power system, timely processing rate of network security alarms in the power system, patch repair rate of power system hosts, power system Compliance rate of terminal patch updates, changing trends of high-risk network attacks, completion rate of training plans for network security personnel and the network security threat situation of the power system;

Secondary cyberspace security factors in terms of security effects include: the average discovery rate of network security risks in external third-party audits, the average discovery rate of network security risks in self-examination by internal operation and maintenance personnel, the average discovery rate of network security risks in internal audits, and external network security-related attacks and defenses. Competition winning rate, internal network security-related offensive and defensive competition winning rate, internal network security-related offensive and defensive competition participation rate, and internal network security-related emergency drill participation rate.

As a further description of the above technical solution:

The average self-examination network security risk discovery rate of the internal operation and maintenance personnel, the average internal audit network security risk discovery rate, the winning rate of external network security-related offensive and defensive competitions, the winning rate of internal network security-related offensive and defensive competitions, and the participation rate of internal network security-related offensive and defensive competitions. and the participation rate in internal network security-related emergency drills are bonus points.

As a further description of the above technical solution:

In the cyberspace security situation of power industry units, the cyberspace security situation of a certain level unit is composed of the cyberspace security situation of its subordinate units, and the cyberspace security situation of a certain level unit constitutes the cyberspace security situation of its superior units.

As a further description of the above technical solution:

The weight value can be set according to the importance of each subordinate unit to a certain unit to reflect the importance of the cyberspace security situation of each subordinate unit in the cyberspace security situation of its direct superior unit.

As a further description of the above technical solution:

The method for determining the weight of cyberspace security factors of units at all levels includes determining the initial weight of cyberspace security factors of units at all levels based on the AHP analytic hierarchy process method, then judging the consistency based on the improved matrix, and checking and calculating the consistency index or index CI and randomness. The consistency ratio CR is determined, and when it is determined that the consistency is unacceptable, that is, when CR is greater than or equal to 1, the above adjustment steps are repeated.

As a further description of the above technical solution:

The improved matrix is specifically improved by using the Moody chart method. After determining the comparison elements, that is, the weight indicators, the improved judgment matrix is obtained by quickly and simply assigning values between each two indicators in the judgment matrix. .

In summary, due to the adoption of the above technical solutions, the beneficial effects of the present invention are:

In the present invention, by using the improved analytic hierarchy process to determine the initial weights of network space security factors of units at all levels, rapid matrix fitting of indicators between multi-level structures in the decision-making process can be achieved, and rationality in the decision-making process can be improved. Avoiding the "amplification effect" caused by the reciprocal relationship between two indicators, the comprehensive evaluation accuracy in the future will be conducive to quickly discovering cyberspace security issues and providing feedback through QR codes, which will be conducive to subsequent proposed adjustments to network security factors. Improving the ability to determine the security situation of electric power basic cyberspace can be used to evaluate the cyberspace security situation of multiple power industry units, and provide visual and quantitative evaluation reference for network security managers of participating assessment units.

Description of the drawings

Figure 1 is a schematic flow chart of a comprehensive assessment method based on the cyberspace security situation reflected by the QR code proposed by the present invention;

Figure 2 is a schematic diagram of the adjustment process of cyberspace security factors based on the comprehensive assessment method of cyberspace security situation reflected by the QR code proposed by the present invention;

Figure 3 is a schematic flow chart of determining the network security QR code based on network space security factors based on a comprehensive assessment method of the cyberspace security situation reflected by the QR code proposed by the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present invention.

Please refer to Figures 1-3. The present invention provides a technical solution: a comprehensive assessment method based on network security QR code technology to reflect the cyberspace security situation of multi-level power industry units, including the following steps: Cyberspace security factors of units at all levels Determination; data collection of cyberspace security factors of units at all levels; determination and display of the cyberspace security situation of units at all levels; among them, the cyberspace security factors that constitute the network security QR code of units at all levels need to be adjusted according to the actual situation to reflect their network Space security situation; The determination of the cyberspace security situation of units at all levels needs to be carried out step by step based on the unit level.

The multi-level power industry units can be divided into head offices, provincial companies, municipal companies, district (or county) companies, related branches, and related subsidiaries. The cyberspace security factors of the units at all levels include: new cyberspace Security factors are added, existing cyberspace security factors are modified, and existing cyberspace security factors are deleted.

It also includes an adjustment process for cyberspace security factors including: adjustment proposal, soliciting opinions, and adjustment confirmation. In the adjustment proposal process, relevant units participating in the cyberspace security situation assessment work will propose adjustment proposals and give specific adjustment suggestions in the proposals. During the opinion solicitation process, relevant units participating in the cyberspace security situation assessment work will provide opinions. In the adjustment determination process, the decision-maker determines the adjustment of cyberspace security factors.

For the same network security issue A, if unit A involves host B, and unit B involves host C, then when calculating the rectification rate of high-risk network security issues in the power system of units A and B or the low-risk network security issues in the power system When calculating the rectification rate, the network security issues involved are B and C respectively, not 1 (unless B and C are both 1). When calculating the security situation in cyberspace, it is also necessary to consider the number of assets involved;

The average discovery rate of network security risks = ((number of assets involved in risk 1/total number of assets that may be involved in risk 1)+(number of assets involved in risk 2/total number of assets that may be involved in risk 2)+…+(number of assets involved in risk N/risk N may involve the total number of assets))/N, where N is the number of risk types, risk 1, risk 2...Risk N is different types of risks. The cyberspace security factors involved in the average discovery rate of network security risks include: the average discovery rate of network security risks in external third-party audits, the average discovery rate of network security risks in self-examination by internal operation and maintenance personnel (extra points), and the average discovery rate of network security risks in internal audits. rate (extra points);

For a certain network security attack and defense competition GameA, the corresponding competition level weight is LevelA, the corresponding reward level weights are PrizeA1, PrizeA2...PrizeAn, and the number of winners corresponding to unit Unit1 is WinnerNumberA1, WinnerNumberA2...WinnerNumberAn. Therefore, the winning rate of unit Unit1 in the network security related attack and defense competition of network security attack and defense competition A is WinningRateOfGameA=((PrizeA1 X WinnerNumberA1)+(PrizeA2 XWinnerNumberA2)+…+(PrizeAn For multiple network security attack and defense competitions GameA, GameB...GameM, the corresponding competition level weights are GameWeightA, GameWeightB...GameWeightM respectively. The winning rate of the network security related attack and defense competition of unit Unit1 = ((WinningRateOfGameA X GameWeightA) + (WinningRateOfGameB XGameWeightB) + …+(WinningRateOfGameN X GameWeightN))/N. The cyberspace security factors involved in the winning rate of network security-related offensive and defensive competitions are: the winning rate of external network security-related offensive and defensive competitions (extra points), and the winning rate of internal network security-related offensive and defensive competitions (extra points).

Participation rate = (number of participations/total number of times) X 100%. The cyberspace security factors involved in the participation rate include: participation rate in internal network security-related offensive and defensive competitions (extra points), and participation rate in internal network security-related emergency drills (extra points).

Referring to Figure 1, the evaluation and display method includes the following steps:

S100, determine the cyberspace security factors of units at all levels.

Among them, in one embodiment, the adjustment process of cyberspace security factors is as shown in Figure 2. The form of soliciting opinions can be discussion in the form of a meeting, or it can be collected and summarized through the "Comment Soliciting Form".

In one embodiment, the cybersecurity-related work compliance rate involves work including but not limited to: network security level protection, commercial password application, trade secret protection, critical infrastructure protection, and information security risk assessment.

In one embodiment, the issues involved in the rectification rate of high-risk network security issues in the power system and the rectification rate of low-risk network security issues in the power system include: security issues in the physical environment where power system equipment is stored, and network environment security issues involving network equipment and security equipment. Issues involving the host environment security of servers, terminal devices and storage devices, application security issues of application systems in information systems, application systems in industrial control systems, and middleware, data security issues of data stored in power systems, and Management security issues of the management system and its execution records.

In one embodiment, the work involved in the timely processing of power system network security alarms includes but is not limited to: network security-related alarms issued by the power system itself, network security-related alarms issued by network security monitoring equipment or systems. Network security monitoring equipment or systems include but are not limited to: environmental power monitoring systems, temperature and humidity monitoring systems, intrusion prevention systems (IPS), intrusion detection systems (IDS), network audit systems, network traffic traceback analysis systems, APT attack detection systems, Honeypots, Internet behavior management equipment, anti-virus walls, host firewall software, host intrusion detection (HIDS), malicious code prevention software, terminal security response system (EDR), application firewall, data leakage prevention system (DLP), database audit system, Database firewall, application vulnerability monitoring system, vulnerability scanning system, unified threat management (UTM), security operation center (SOC), security information and event management (SIEM) system, security situation awareness system.

In one embodiment, the power system host includes, but is not limited to: an information system server and an industrial control system host.

In one embodiment, high-risk network attacks refer to network attacks that utilize weaknesses with a CVSS (Common Vulnerability Scoring System) score of greater than or equal to 7.

In one embodiment, the change trend of high-risk network attacks is mainly obtained by comparing the change with the number of times in the previous period.

In one embodiment, the work involved in the training of network security-related personnel includes but is not limited to: network security-related awareness training, knowledge training, skills training, and related assessments, competitions, and drills.

In one embodiment, the network security threat situation involving the power system includes but is not limited to: CNCERT (National Internet Emergency Center) security index, inspections or exercises organized by superior units or industry competent units, superior units, industry competent units or industry Cyber security threat intelligence information reported by other units within the company, and cyber security incidents occurring within the industry.

S110. Determine the weight of cyberspace security factors for units at all levels.

In one embodiment, when determining the initial weights of cyberspace security factors of units at all levels based on the AHP method, the cyberspace security situation corresponds to the A layer (purpose layer) of the AHP method, and the first-level cyberspace security factors correspond to the AHP method. The N layer (system layer) and the secondary network space security factors correspond to the P layer (policy layer) of the AHP method. See Table 1 for details. Construct a judgment matrix, and according to T.L. Saaty's nine-level scaling method, which can be further refined based on pairwise comparison of relative importance indicators, take 1 to 9 and its reciprocal. T.L.Saaty's nine-level scaling method and its meaning are shown in Table 2. For N-level judgments A to N, the corresponding judgment matrix is shown in Table 3. For the P layer judgment N～P, the corresponding judgment matrices are shown in Table 4 to Table 7.

In one embodiment, the consistency check process is: for the A to N judgment matrix B, calculate the eigenvector ω that satisfies Bω=λmaxω (λmax is the maximum eigenvalue), and normalize it, then its corresponding component That is the weight value of this level. Calculate the maximum eigenvalue (or maximum eigenroot) λmax of the judgment matrix; calculate the consistency index CI=(λmax-n)/(n-1), where n is the number of rows of the judgment matrix, that is, in the hierarchy Number of indicators. Calculate the random consistency ratio CR=CI/RI, where RI is the random consistency index, see Table 8. For the case where CR is greater than or equal to 1, adjust the A～N judgment matrix and N～P judgment matrix until CR is less than 1.

S120, data collection of cyberspace security factors for units at all levels.

In one embodiment, during the data collection process of cyberspace security factors of units at all levels, it starts from the grassroots unit and is summarized layer by layer to the upper level. Data collection personnel at all levels are responsible for data collection within their respective scopes of responsibility, and each unit assigns a dedicated person to be responsible for the data quality of the unit.

S130, determine and display the cyberspace security situation of units at all levels.

In one embodiment, the cyberspace security situation of each unit is divided into green code, yellow code and red code, which need to be determined based on the cyberspace security factor data of units at each level. See Figure 3 for the specific process.

The following is a further explanation of a comprehensive assessment method based on the network security QR code technology of the present invention that reflects the network space security situation of multi-level power industry units with reference to an embodiment, as shown in Table 9. Table 10 gives a corresponding rule for network security-related offensive and defensive competition levels and award levels, which is used to determine the winning rate (additional points) of external network security-related offensive and defensive competitions and the winning rate (additional points) of internal network security-related offensive and defensive competitions;

Table 1 Hierarchical structure of cyberspace security factor system for units at all levels

Table 2 Saaty nine-level scaling method and its meaning

Table 3 A～N matrix table

A N1 N2 N3 N4 N1 1 2 3 4 N2 1/2 1 1/3 1/2 N3 1/3 3 1 1/2 N4 1/4 2 2 1

Table 4 N1～P matrix table

N1 P1 P2 P1 1 2 P2 1/2 1

Table 5 N2～P matrix table

N2 P3 P4 P3 1 2 P4 1/2 1

Table 6 N3～P matrix table

N3 P5 P6 P7 P8 P9 P10 P11 P12 P5 1 9 2 3 2 7 8 9 P6 1/9 1 1/2 1/3 1/2 1/7 1/8 1/9 P7 1/2 2 1 2 3 7 8 9 P8 1/3 3 1/2 1 4 7 8 9 P9 1/2 2 1/3 1/4 1 2 4 5 P10 1/7 7 1/4 1/7 1/2 1 2 3 P11 1/8 8 1/8 1/8 1/4 1/2 1 2 P12 1/9 9 1/9 1/9 1/5 1/3 1/2 1

Table 7 N4～P matrix table

N4 P13 P14 P15 P16 P17 P18 P19 P13 1 3 2 4 5 6 5 P14 1/3 1 1/2 3 4 5 4 P15 1/2 2 1 3 4 5 4 P16 1/4 1/3 1/3 1 9 8 2 P17 1/5 1/4 1/4 1/9 1 8 9 P18 1/6 1/5 1/5 1/8 1/8 1 1/2 P19 1/5 1/4 1/4 1/2 1/9 2 1

Table 8 Average random consistency index table

Table 9 A cyberspace security situation classification method and its determination rules

Table 10 Corresponding rules for network security related offensive and defensive competition levels and award levels

The above are only preferred specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person familiar with the technical field can, within the technical scope disclosed in the present invention, implement the technical solutions of the present invention. Equivalent substitutions or changes of the inventive concept thereof shall be included in the protection scope of the present invention.

Claims (1)

1. A comprehensive assessment method based on the cyberspace security situation reflected by QR codes, applied to power industry units, which is characterized by including the following steps: S1. Determine the cyberspace security factors of units at all levels based on the unit level; S2. Analyze the weight of cyberspace security factors of units at all levels based on the unit level; S3. Collect data on cyberspace security factors of units at all levels based on the unit level; S4. Determine and display the cyberspace security situation of units at all levels based on the unit level; Among them, the weights of cyberspace security factors of units at all levels are adjusted according to their levels to reflect their cyberspace security situation; It also includes an adjustment process for cyberspace security factors. The adjustment process includes: adjustment proposal, soliciting opinions, and adjustment determination; in the adjustment proposal process, relevant units participating in the cyberspace security situation assessment work put forward adjustment proposals, and Specific adjustment suggestions are given in the proposal; in the opinion solicitation process, relevant units participating in the cyberspace security situation assessment work provide opinions; in the adjustment determination process, the decision-maker determines the adjustment of cyberspace security factors; The cyberspace security situation of the power industry unit is reflected through a network security QR code, and the network security QR code is generated by corresponding cyberspace security factors; The cyberspace security factors include deducted cyberspace security factors and bonus cyberspace security factors, and the cyberspace security factors with bonus points are used to influence the weight of the determination of the cyberspace security situation; The cyberspace security factors are divided into: first-level cyberspace security factors and secondary cyberspace security factors; The first-level cyberspace security factors are divided into security management factors, security construction factors, security operation factors and security effect factors; Among them, the secondary cyberspace security factors in security management include: completion rate of important cyber security tasks and compliance rate of cyber security-related work; Secondary cyberspace security factors in terms of security construction include: progress compliance rate of key construction projects and progress compliance rate of key promotion projects; Secondary cyberspace security factors in terms of safe operation include: rectification rate of high-risk network security issues in the power system, rectification rate of medium- and low-risk network security issues in the power system, timely processing rate of network security alarms in the power system, patch repair rate of power system hosts, power system Compliance rate of terminal patch updates, changing trends of high-risk network attacks, completion rate of training plans for network security personnel and the network security threat situation of the power system; Secondary cyberspace security factors in terms of security effects include: the average discovery rate of network security risks in external third-party audits, the average discovery rate of network security risks in self-examination by internal operation and maintenance personnel, the average discovery rate of network security risks in internal audits, and external network security-related attacks and defenses. Competition winning rate, internal network security-related offensive and defensive competition winning rate, internal network security-related offensive and defensive competition participation rate, and internal network security-related emergency drill participation rate; The average self-examination network security risk discovery rate of the internal operation and maintenance personnel, the average internal audit network security risk discovery rate, the winning rate of external network security-related offensive and defensive competitions, the winning rate of internal network security-related offensive and defensive competitions, and the participation rate of internal network security-related offensive and defensive competitions. and the participation rate in internal network security-related emergency drills are bonus points; In the cyberspace security situation of units in the electric power industry, the cyberspace security situation of a certain level unit is composed of the cyberspace security situation of its subordinate units, and the cyberspace security situation of a certain level unit constitutes the cyberspace security situation of its superior unit; Set the weight value according to the importance of each subordinate unit to a certain unit to reflect the importance of the cyberspace security situation of each subordinate unit in the cyberspace security situation of its direct superior unit; The work involved in the compliance rate of cybersecurity-related work includes: network security level protection, commercial password application, trade secret protection, critical infrastructure protection, and information security risk assessment; The issues involved in the rectification rate of high-risk network security issues in the power system and the rectification rate of medium- and low-risk network security issues in the power system include: security issues in the physical environment where power system equipment is stored, security issues in the network environment involving network equipment and security equipment, and issues involving servers and terminals. The host environment security of equipment and storage devices involves application security issues of application systems in information systems, application systems in industrial control systems, and middleware, data security issues of data stored in power systems, and management systems and their execution records. management security issues; The work involved in the timely processing of power system network security alarms includes: network security-related alarms issued by the power system itself, network security-related alarms issued by network security monitoring equipment or systems; Network security monitoring equipment or systems include: environmental power monitoring system, temperature and humidity monitoring system, intrusion prevention system, intrusion detection system, network audit system, network traffic traceback analysis system, APT attack detection system, honeypot, Internet behavior management equipment, anti-virus Wall, host firewall software, host intrusion detection, malicious code prevention software, terminal security response system, application firewall, data leakage prevention system, database audit system, database firewall, application vulnerability monitoring system, vulnerability scanning system, unified threat management, security operation Center, security information and event management system, security situation awareness system; Power system hosts include: information system servers and industrial control system hosts; High-risk network attacks refer to network attacks that exploit weaknesses with a score of greater than or equal to 7 in the universal vulnerability scoring system; The changing trend of high-risk network attacks is obtained by comparing the number changes with the previous cycle; The work involved in the training of cybersecurity-related personnel includes: cybersecurity-related awareness training, knowledge training, skills training, as well as related assessments, competitions and drills; The cybersecurity threat situation involving the power system includes: the National Internet Emergency Center security index, inspections or exercises organized by superior units or industry supervisory units, network security threat intelligence information reported by superior units, industry supervisory units, or other units in the industry, Cybersecurity incidents occurring within the industry; The method for determining the weight of cyberspace security factors for units at all levels includes determining the initial weights of cyberspace security factors for units at all levels based on the AHP analytic hierarchy process method, then judging the consistency based on the improved judgment matrix, and checking and calculating the consistency index or index CI. and random consistency ratio CR, and make a judgment. When it is judged that the consistency is unacceptable, that is, when CR is greater than or equal to 1, adjust the improved judgment matrix until CR is less than 1; The improved matrix is specifically improved by using the Moody chart method. After determining the comparison elements, that is, the weight indicators, the improved judgment matrix is obtained by quickly and simply assigning values between each two indicators in the judgment matrix.